System resource access control method and device, terminal, storage medium and product

Abstract

The embodiment of the invention discloses a system resource access control method and device, a terminal, a storage medium and a product, and relates to the field of information security. Comprising the steps that under the condition that a system resource access request of an application program is received and the application program has a system resource access permission, fence area information is obtained, and the fence area information is used for indicating a fence area in a physical world; providing system resources corresponding to the system resource access request for the application program under the condition that the current geographic position is located in the fence area; and under the condition that the current geographic position is located outside the fence area, prohibiting providing system resources corresponding to the system resource access request to the application program. By adopting the method provided by the embodiment of the invention, the application program is prevented from abusing the system resource access authority, and the privacy security of the user is protected.

Description

Technical Field

[0001] This application relates to the field of information security, and in particular to a method, apparatus, terminal, storage medium and product for access control of system resources. Background Technology

[0002] During terminal use, applications can request various types of data access permissions from users, such as location permission, microphone permission, camera permission, storage permission, photo album permission, and so on. For example, an application can request location permission from the user via a pop-up window, and the user can choose to deny authorization, grant permission only when the application is in the foreground, or grant permission for both the foreground and background.

[0003] Users can revoke or grant data access permissions for various applications on the permissions management page. Because frequently managing application data access permissions is cumbersome, users often grant persistent data access permissions to frequently used applications. For example, food delivery apps may hold location permissions for extended periods, or social media apps may hold photo album permissions for a long time. However, prolonged data access permissions by applications may pose a risk of user privacy theft. Summary of the Invention

[0004] This application provides a method, apparatus, terminal, storage medium, and product for access control of system resources. The technical solution is as follows:

[0005] On one hand, embodiments of this application provide a method for access control of system resources, the method comprising:

[0006] Upon receiving a system resource access request from an application, and provided that the application has system resource access permissions, fenced area information is obtained, which is used to indicate fenced areas in the physical world.

[0007] If the current geographical location is within the fenced area, provide the application with the system resources corresponding to the system resource access request;

[0008] If the current geographical location is outside the fenced area, the system resources corresponding to the system resource access request are prohibited from being provided to the application.

[0009] On the other hand, embodiments of this application provide a system resource access control device, the device comprising:

[0010] The acquisition module is used to acquire fenced area information when it receives a system resource access request from an application and the application has system resource access permissions. The fenced area information is used to indicate fenced areas in the physical world.

[0011] The control module is used to provide the application with the system resources corresponding to the system resource access request when the current geographical location is within the fenced area;

[0012] The control module is also configured to prohibit the application from accessing the system resources corresponding to the system resource access request when the current geographical location is outside the fenced area.

[0013] On the other hand, embodiments of this application provide a terminal, the terminal including a processor and a memory, the memory storing at least one computer instruction, the at least one computer instruction being loaded and executed by the processor to implement the method as described above.

[0014] On the other hand, embodiments of this application provide a computer-readable storage medium storing at least one computer instruction, which is loaded and executed by a processor to implement the method described above.

[0015] On the other hand, embodiments of this application provide a computer program product including computer instructions stored in a computer-readable storage medium. A terminal's processor reads the computer instructions from the computer-readable storage medium and executes the computer instructions, causing the terminal to perform the methods provided in the various optional implementations of the above aspects.

[0016] In this embodiment, upon receiving a system resource access request from an application, and given that the application has system resource access permissions, the terminal can determine the fenced area where the application's system resource access permissions are effective by obtaining fenced area information. If the current geographical location is within the fenced area, it indicates that the application's system resource access permissions are effective, and the terminal provides the application with the system resources corresponding to the system resource access request, thereby ensuring the normal use of the application. If the current geographical location is outside the fenced area, it indicates that the application's system resource access permissions are ineffective, and the terminal prohibits providing the application with the system resources corresponding to the system resource access request, thus preventing the application from abusing system resources. Therefore, the system resource access control method proposed in this application can achieve fine-grained control over system resource access permissions, preventing applications from abusing system resource access permissions and protecting user privacy and security. Attached Figure Description

[0017] To more clearly illustrate the technical solutions in the embodiments of this application, the accompanying drawings used in the description of the embodiments will be briefly introduced below. Obviously, the accompanying drawings described below are only some embodiments of this application. For those skilled in the art, other drawings can be obtained based on these drawings without creative effort.

[0018] Figure 1 This is a flowchart of an access control method for system resources provided in an exemplary embodiment of this application;

[0019] Figure 2 This is a flowchart illustrating the process of obtaining fenced area information as provided in an exemplary embodiment of this application;

[0020] Figure 3 This is a schematic diagram illustrating a display method of historical system resource access records provided in an exemplary embodiment of this application;

[0021] Figure 4 This is a schematic diagram illustrating the filtering of historical system resource access records provided in an exemplary embodiment of this application;

[0022] Figure 5 This is an exemplary embodiment of the present application providing a diagram illustrating the construction of a correspondence between application information and fence area information, or a correspondence between request information and fence area information, based on a fence setting operation received.

[0023] Figure 6 This is a schematic diagram of a first fenced area and a second fenced area provided in an exemplary embodiment of this application;

[0024] Figure 7 This is a flowchart illustrating a terminal notification to a user to modify system resource access permissions for an application, provided in an exemplary embodiment of this application.

[0025] Figure 8 This is a schematic diagram of data interaction between various components of a terminal when the system resource is location data, provided by an exemplary embodiment of this application;

[0026] Figure 9 This is a structural block diagram of an access control device for system resources provided in an exemplary embodiment of this application;

[0027] Figure 10 This is a structural block diagram of a terminal provided in an exemplary embodiment of this application. Detailed Implementation

[0028] To make the objectives, technical solutions, and advantages of this application clearer, the embodiments of this application will be described in further detail below with reference to the accompanying drawings.

[0029] It should be noted that during the collection of user data (such as real-time location), this application may display a prompt interface, pop-up window, or output voice prompt information. This prompt interface, pop-up window, or voice prompt information is used to inform the user that their data is currently being collected. This ensures that the application only begins the steps for collecting user data after receiving confirmation from the user regarding the prompt interface or pop-up window; otherwise (i.e., without receiving confirmation from the user), the steps for collecting user data end, meaning no user data is collected. In other words, the information involved in this application (including but not limited to user device information, user personal information, and user real-time location), data (including but not limited to data used for analysis, stored data, and displayed data), and signals are all authorized by the user or fully authorized by all parties, and the collection, use, and processing of related data must comply with the relevant laws, regulations, and standards of the relevant countries and regions. For example, the user's real-time location involved in this application was obtained with full authorization.

[0030] See Figure 1 , Figure 1 This is a flowchart of an access control method for system resources provided in an exemplary embodiment of this application, which includes the following steps.

[0031] Step 101: Upon receiving a system resource access request from an application, and provided that the application has system resource access permissions, obtain fenced area information, which is used to indicate fenced areas in the physical world.

[0032] An application (APP) can be a system application of the terminal (such as a photo album, memo, phone or voice recorder) or a third-party application (such as a social app, food delivery app, map app, shopping app, video app, etc.), and there are no restrictions on this.

[0033] A system resource access request is used to request access to system resources. Optionally, the system resource access request includes an access request for at least one system resource selected from location data, camera data, microphone data, sensor data, photo album data, contact list data, and file data. In addition, system resources can also be other types of resources managed by the terminal system, such as recorder data. Those skilled in the art can specify the type of system resource according to actual needs, and there are no limitations on this.

[0034] Taking Android systems as an example, where system resource access requests are location data access requests, in some embodiments, applications can send location data access requests to the LocationManager component and then forward these requests to the LocationManagerService component by calling its location data access interface. Different types of location data access requests correspond to different location data access interfaces. For example, precise location data access requests correspond to the precise location data access interface, and coarse location data access requests correspond to the coarse location data access interface.

[0035] It should be noted that the above example only takes the application in the Android system initiating a location data access request as an example to illustrate the system resource access request received by the terminal from the application. In fact, the system resource access control method proposed in this application can also be applied to other systems (such as the iOS system (Internetwork Operating System)), and the system resource access request can also be an access request for various other types of system resources, without limitation.

[0036] System resource access permissions refer to the access permissions an application requests for system resources. In one possible approach, the terminal can request system resource access permissions from the user via a pop-up window or similar method before initiating the request. For example, when requesting location data access permissions, the user can choose to grant permissions only when the application is in the foreground, or grant permissions for both foreground and background operation. In another possible implementation, the user can also proactively grant system resource access permissions to applications through a permission management page, without restricting the specific method by which the application obtains these permissions.

[0037] In some embodiments, the LocationManagerService component can send a permission query request to the PermissionManager component to determine whether the application has access to system resources based on the permission query results returned by the PermissionManager component.

[0038] Fence area information is used to indicate fenced areas in the physical world.

[0039] For example, fence area information may include boundary information of a closed shape, wherein the area enclosed by the closed shape is the fence area in the physical world indicated by the fence area information.

[0040] For example, the fence area information may include the coordinates of the fence center and the length of the fence radius. The fence area in the physical world indicated by the fence area information is the circular area formed by the fence center and the fence radius.

[0041] For example, fenced area information may also include POI (Point of Interest) data. In this case, the fenced area in the physical world indicated by the fenced area information is the geographical area formed by the POI data. For instance, if the POI data is the location data corresponding to a shopping mall, then the fenced area is the geographical area where the shopping mall is located.

[0042] For example, fenced area information can also be identification information indicating a geographic administrative division. For instance, if the fenced area information is a postal code, then the fenced area in the physical world indicated by the fenced area information is the geographic administrative region indicated by that postal code.

[0043] It should be noted that the specific form of the fenced area information described above is only an example. Those skilled in the art can set other forms of fenced area information according to actual needs to indicate fenced areas in the physical world, and there are no restrictions on this.

[0044] Regarding the method of obtaining fenced area information, in some embodiments, the terminal can obtain fenced area information from the fence information management component LocHistory.

[0045] In some embodiments, the fence information management component may store the correspondence between different application information and fence area information; in other embodiments, the fence information management component may store the correspondence between different request information and fence area information. Therefore, the terminal can obtain fence area information from the fence information management component based on the application information or request information corresponding to the current system resource access request.

[0046] For more information on obtaining fenced area information, please see [link / reference]. Figure 2 The details and related descriptions will not be repeated here.

[0047] Step 102: If the current geographical location is within the fenced area, provide the application with the system resources corresponding to the system resource access request.

[0048] The current geographic location is the current location of the terminal. The terminal can determine its current geographic location through GPS (Global Positioning System), GIS (Geographic Information System), GSM (Global System for Mobile Communication), or other location acquisition technologies, without any restrictions.

[0049] A fenced area is the area where an application's system resource access permissions are effective. When the current geographical location is within the fenced area, the terminal provides the application with the system resources corresponding to the system resource access request.

[0050] For example, the effective area (i.e., the fenced area) for location data access permissions of a food delivery app is a circular area within 1 kilometer of the user's home. Therefore, if the user's current geographic location is within this 1-kilometer circular area, when the food delivery app initiates a location data access request, the user can provide the app with the location data corresponding to the request (such as a precise or approximate current geographic location).

[0051] Step 103: If the current geographical location is outside the fenced area, prohibit providing the application with the system resources corresponding to the system resource access request.

[0052] When the current geographical location is outside the fenced area, the terminal is not in the effective area of ​​system resource access permissions. Therefore, the terminal does not provide the system resources corresponding to the system resource access request to the application, thereby avoiding the abuse of system resource access permissions by the application and protecting user privacy and security.

[0053] In some embodiments, the fenced areas corresponding to different system resources accessed by the application are different.

[0054] As an example, for an attendance app, the fenced area for accessing location data might be a circular area within 1 kilometer of the company, while the fenced area for accessing camera data might be a circular area within 100 meters of the company. Therefore, when the current geographical location is within the circular area within 1 kilometer of the company but not within the circular area within 100 meters, the terminal can provide the location data corresponding to the location data access request to the attendance app, but will not provide the camera data corresponding to the camera data access request. Since camera data can only be obtained by the attendance app when the user is within 100 meters of the company, this avoids the possibility of the attendance app abusing camera data when the user is outside the company's vicinity.

[0055] In one possible implementation, the terminal may not respond if the current geographic location is outside the fenced area; in another possible implementation, the terminal may send a request failure message to the application to inform the application that the current geographic location is outside the fenced area.

[0056] In summary, upon receiving a system resource access request from an application, and given that the application has the necessary system resource access permissions, the terminal can determine the effective fenced area for the application's system resource access permissions by obtaining fenced area information. If the current geographical location is within the fenced area, it indicates that the application's system resource access permissions are effective, and the terminal provides the application with the system resources corresponding to the access request, thus ensuring the normal operation of the application. If the current geographical location is outside the fenced area, it indicates that the application's system resource access permissions are ineffective, and the terminal prohibits providing the application with the system resources corresponding to the access request, preventing the application from abusing system resources. Therefore, the system resource access control method proposed in this application can achieve fine-grained control over system resource access permissions, preventing applications from abusing system resource access permissions and protecting user privacy and security.

[0057] Regarding the methods for obtaining fence area information, the terminal can obtain fence area information corresponding to the application from the application level, or it can obtain fence area information corresponding to the system resource access request from the system resource access request level.

[0058] In some embodiments, the terminal can obtain the fence area information corresponding to the application based on the correspondence between application information and fence area information.

[0059] Optionally, application information includes various information about the application, such as the application package name, application type, application running status, and application usage frequency.

[0060] In some embodiments, the terminal pre-stores the correspondence between various application information and fenced area information.

[0061] See Figure 2 , Figure 2 This is a flowchart illustrating the process of obtaining fenced area information according to an exemplary embodiment of this application. The process includes the following steps.

[0062] Step 211: Based on the correspondence between the application package name and the fenced area information, obtain the fenced area information corresponding to the application.

[0063] In some embodiments, if the terminal pre-stores the correspondence between each application package name and fenced area information, the terminal can obtain the fenced area information corresponding to the application that is currently initiating the access request.

[0064] Table 1 below illustrates the correspondence between application package names and fenced area information.

[0065] Application package name Fenced area information Application package name A Area within 1 kilometer of home Application package name B The area where the shopping mall's POI data is located Application package name C The area within 100 meters of the company

[0066] Table 1

[0067] In some embodiments, the same application may correspond to different fenced area information for system resources of different resource types.

[0068] Table 2 below illustrates the correspondence between different resource types and fenced area information for various applications.

[0069]

[0070] Table 2

[0071] Step 212: Based on the correspondence between application type and fence area information, obtain the fence area information corresponding to the application.

[0072] Different application types correspond to different fenced area information.

[0073] In some embodiments, the terminal pre-stores the correspondence between various application types and fenced area information, so the terminal can obtain the fenced area information corresponding to the application based on the application type of the application that is currently initiating the access request.

[0074] Table 3 below illustrates the correspondence between various application types and fenced area information.

[0075] Application type Fenced area information social applications Area 1 Shopping Apps Area 2 Video application Area 3

[0076] Table 3

[0077] Step 213: Based on the correspondence between the application's running status and the fence area information, obtain the fence area information corresponding to the application.

[0078] The application's running status includes foreground running status and background running status.

[0079] For example, for a fitness app, the fence area indicated by the fence area information corresponding to the foreground running state is relatively small (e.g., the user's commonly used exercise range), while the fence area indicated by the fence area information corresponding to the background running state is relatively large (e.g., the range within 8 kilometers of the user's home).

[0080] It should be noted that steps 211, 212 and 213 can be executed one at a time in parallel steps, or they can be a combination of two or three steps executed simultaneously. For example, for the same application type, different application running states can correspond to different fence area information, and there is no restriction on this.

[0081] In some embodiments, the terminal can obtain the fenced area information corresponding to the system resource access request based on the correspondence between the request information and the fenced area information.

[0082] Optionally, the request information includes various types of information related to system resource access requests, such as the request time, the request time period to which the request time belongs, the resource type of the system resource to be accessed, and the number of requests.

[0083] In some embodiments, the terminal pre-stores the correspondence between various types of request information and fenced area information.

[0084] Step 214: Based on the correspondence between the request time period and the fenced area information, obtain the fenced area information corresponding to the system resource access request.

[0085] In some embodiments, the terminal stores the correspondence between different request time periods and fenced area information. Therefore, the corresponding fenced area information can be determined based on the request time period corresponding to the current system resource access request.

[0086] Table 4 below illustrates the correspondence between various request time periods and fenced area information.

[0087] Requested time period Fenced area information Morning rush hour Area 1 noon Area 2 evening Area 3

[0088] Table 4

[0089] Step 215: Based on the correspondence between resource type and fenced area information, obtain the fenced area information corresponding to the system resource access request.

[0090] The resource type refers to the type of system resource requested for access. For example, resource types include at least one of the following: location data, camera data, microphone data, sensor data, photo album data, contact list data, and file data.

[0091] In some embodiments, each resource type may also include multiple sub-types of different resources. For example, location data may be further subdivided into precise location data, coarse location data, real-time location data, and location change data for future periods, etc.

[0092] In some embodiments, the terminal stores the correspondence between different resource types and fenced area information. Therefore, the corresponding fenced area information can be determined based on the resource type corresponding to the current system resource access request.

[0093] Table 5 below illustrates the correspondence between various resource types and fenced area information.

[0094] Resource types Fenced area information Precise positioning data Within 100 meters of home Rough location data Within 500 meters of home Sensor data Route area from home to work

[0095] Table 5

[0096] It should be noted that steps 214 and 215 can be either executed separately or in combination. For example, for the same resource type, different request periods can correspond to different fenced area information, and there is no restriction on this.

[0097] It should be noted that steps 211 to 215 can be parallel steps that can be executed one at a time, or steps that can be executed simultaneously in combination of two or more.

[0098] Table 6 below illustrates the correspondence between various application information, various request information, and fenced area information.

[0099]

[0100]

[0101] Table 6

[0102] It should be noted that those skilled in the art can determine the correspondence between different application information and / or different request information and fenced area information according to actual needs, and store it in the terminal in advance, without any limitation.

[0103] In this embodiment, by establishing a correspondence between at least one of the application information and request information and the fenced area information, the terminal can obtain the fenced area information corresponding to the system resource access request under different actual circumstances, so as to determine whether the system resources need to be sent to the application, thereby realizing fine-grained management of system resource access permissions.

[0104] To further facilitate users' fine-grained management of system resource access permissions, in some embodiments, the terminal can store historical system resource access records of various applications and display them to the user for viewing.

[0105] In some embodiments, the terminal can generate historical system resource access records based on application information, current geographical location, system resource access request information, and request results.

[0106] In one possible scenario, the terminal can generate and store historical system resource access records after providing the system resources corresponding to the system resource access request to the application; in another possible scenario, the terminal can also generate and store historical system resource access records when providing system resources to the application is prohibited.

[0107] Optionally, application information includes various information about the application, such as the application package name, application type, application running status, and application usage frequency.

[0108] Optionally, the request information includes various information about system resource access requests, such as the request time, the request time period to which the request time belongs, the resource type of the system resource to be accessed, and the number of requests.

[0109] Optionally, the request result may include request success and request failure, or the request result may also include system resources provided by the terminal to the application.

[0110] In some embodiments, the historical system resource access records of each application can be stored in the fence information management component of the terminal.

[0111] See Figure 3 , Figure 3 This is a schematic diagram illustrating a display method of historical system resource access records provided in an exemplary embodiment of this application.

[0112] like Figure 3 As shown, the terminal can display historical system resource access records in the privacy dashboard 310 in the form of list data. These records can include the request time, geographical location, requested resource type, and request result of each application when it initiated a system resource access request. Since users can view the geographical location when an application initiated a system resource access request, they can determine whether the application is abusing its permissions. If permission abuse is found (e.g., the geographical location of the request is not the location where the user actively operated the application), the user can modify the application's system resource access permissions.

[0113] In some embodiments, in response to viewing historical system resource access records, the terminal displays markers on a map based on the historical system resource access records.

[0114] Optionally, the viewing operation can be a click operation on the viewing control in the privacy dashboard, or it can be a special gesture operation (such as multi-finger touch screen) or a shortcut key operation, etc. There are no restrictions on the specific form of the viewing operation.

[0115] The markers are used to represent historical system resource access requests initiated by historical applications at historical geographical locations, as well as the results of those requests. For example, a marker can be a specially marked point on a map, and the point data represents data related to the historical system resource access requests.

[0116] like Figure 3 As shown, when the user clicks the view control 311 in the privacy dashboard 310, the terminal displays the access management page 320. The map of the access management page 320 displays markers (shown as pentagrams) corresponding to multiple historical system resource access records.

[0117] For example, marker 321 indicates that the food delivery app has initiated a precise location data request at location D. However, marker 321 is far from home (for example, marker 321 may be located outside the fenced area). Therefore, the food delivery app may be abusing its location data access permissions. Users can make judgments based on the markers on the map to modify the location data access permissions of the food delivery app.

[0118] In some embodiments, the terminal may display marker-related information around the marker point, or the marker-related information may be displayed around the marker point when the user moves the mouse pointer over the marker point. For example, the terminal may display the following information around marker point 321: the application corresponding to the marker point is a food delivery app, the request time is 23:48:32, the historical geographic location is location D, the resource type is precise location data, and the request result is successful.

[0119] In this embodiment, upon receiving an operation to view historical system resource access records, the terminal displays markers on a map based on these records. Users can then visually view the historical system resource access records of each application on the map, thereby monitoring the permission usage of each application and achieving refined management of system resource access permissions.

[0120] In one possible scenario, there may be a large number of historical system resource access records. To make it easier for users to view historical system resource access records more effectively, users can perform filtering operations on the historical system resource access records.

[0121] Optionally, the filtering operation can be triggered by clicking the filter control, or it can be triggered by other methods such as searching; there are no restrictions on this.

[0122] In some embodiments, in response to a filtering operation on historical system resource access records, the terminal updates the markers displayed on the map based on the filtering criteria indicated by the filtering operation.

[0123] The filtering criteria include at least one of application information filtering criteria and request information filtering criteria.

[0124] Optionally, application information filtering criteria can include filtering criteria based on application package name, application type, or application running status.

[0125] Optionally, the request information filtering criteria may include filtering criteria based on the request time or the resource type of the system resource requested for access.

[0126] For example, the request time period filtering criteria can be the month, date, and time when the application initiates a system resource access request, or the request time period (such as morning, noon, or evening) to which the request time belongs.

[0127] In some embodiments, the markers in the updated map meet the filtering criteria. For example, if the filtering criteria indicate that the historical system resource access records of application package name A are to be filtered, then the markers in the updated map will all represent the historical system resource access records of the application corresponding to application package name A.

[0128] See Figure 4 , Figure 4 This is a schematic diagram illustrating the filtering of historical system resource access records provided in an exemplary embodiment of this application.

[0129] like Figure 4 As shown, the markers displayed on the map represent historical system resource access records where various applications initiated historical system resource access requests at historical geographical locations. For ease of management, users can filter historical system resource access records using the time filter control 401 and / or the application filter control 402.

[0130] For example, when a user selects 2024-01-01 using the time filter control 401 and selects the attendance app using the application filter control 402, the map will only display the markers corresponding to the historical system resource access records of the attendance app in January 2024, making it easier for users to intuitively view the system resource permission usage of the attendance app.

[0131] To further facilitate users' fine-grained management of system resource access permissions, in some embodiments, users can also display fenced area information on a map through the fenced area display operation to intuitively view the fenced areas where the access permissions for each system resource are effective.

[0132] In some embodiments, in response to a fenced area display operation, the terminal determines target fenced area information that matches the filtering criteria.

[0133] Optionally, the fence area display operation can be a trigger operation on the map for the fence area display control, or a special gesture operation, shortcut key operation, etc., and there are no restrictions on this.

[0134] In some embodiments, the target fence area information corresponds to the application information indicated by the application information filtering conditions, and / or the target fence area information corresponds to the request information indicated by the request information filtering conditions.

[0135] For example, if the request information indicated by the request information filter condition is a request date of January 1, 2024, then the target fence area indicated by the target fence area information is the fence area where the resource access permission takes effect on January 1, 2024.

[0136] For example, if the application information indicated by the application information filtering conditions is that the application package name is package name A and the application running state is in the foreground running state, then the target fence area indicated by the target fence area information is the fence area where the resource access permissions of the application corresponding to package name A are effective in the foreground running state.

[0137] For example, if the application information filtering condition indicates that the application type is a food delivery app and the request information filtering condition indicates that the request time period is noon, then the target fence area indicated by the target fence area information is the fence area where the resource access permissions of the application type food delivery app are effective during the noon time period.

[0138] In some embodiments, the terminal displays the target fenced area on a map based on the target fenced area information.

[0139] Optionally, the terminal can display the target fence area indicated by the target fence area information on the map based on special colors, special borders, or any other possible display methods.

[0140] like Figure 4 In the process, after the user filters the historical system resource access records of the attendance APP in January 2024 on the map using the time filter control 401 and the application filter control 402, in response to the trigger operation of the fence area display control 403, the terminal displays the target fence area 404 corresponding to the historical system resource access records on the map to indicate the effective area of ​​the historical system resource access permissions.

[0141] In this embodiment, the filtering operation allows for more targeted viewing of historical system resource access records corresponding to the filtering operation; the fenced area display operation allows users to see the areas where historical system resource access permissions are effective from the target fenced area displayed on the map on the terminal, thereby facilitating users' refined management of system resource access permissions.

[0142] In some embodiments, the terminal pre-stores the correspondence between application information and fenced area information, and / or the correspondence between request information and fenced area information. Therefore, when an application initiates a system resource access request, the terminal can determine the fenced area information corresponding to the fenced area where the system resource access permission is effective based on at least one of the above two correspondences.

[0143] In some embodiments, before obtaining the fence area information corresponding to the application, the terminal can construct a correspondence between application information and fence area information.

[0144] Regarding the method of constructing the correspondence between application information and fenced area information, in one possible implementation, the terminal can construct the correspondence between application information and fenced area information based on historical system resource access records.

[0145] Among them, historical system resource access records are used to characterize historical system resource access requests initiated by historical applications in historical geographical locations, as well as the results of those requests.

[0146] In some embodiments, the terminal can use a machine learning model to predict the fenced area information corresponding to the application information based on various historical geographical locations in the historical system resource access records. For example, the machine learning model can be a convolutional neural network or a graph neural network.

[0147] In other embodiments, the terminal can determine the fenced area information corresponding to the application information based on various historical geographical locations in the historical system resource access records, according to preset rules. For example, the fenced area indicated by the fenced area information can be the smallest area among regions covering 90% of the historical geographical locations.

[0148] In other embodiments, the terminal may also construct a correspondence between application information and fenced area information through clustering algorithms or other feasible methods based on historical system resource access records, without limitation.

[0149] Regarding the method of constructing the correspondence between application information and fence area information, in another possible implementation, the terminal can construct the correspondence between application information and fence area information based on the fence setting operation when it receives a fence setting operation.

[0150] Optionally, the fence setting operation can be triggered by manual drawing by the user. For example, the user can manually draw fence areas corresponding to different application information on the map, and the terminal stores the correspondence between application information and fence area information based on the fence areas drawn by the user.

[0151] Optionally, the fence setting operation can also be triggered by the user inputting relevant parameters of the fence area. For example, the user can input the fence center and fence radius of the fence area corresponding to the application information. The terminal determines the corresponding fence area as a circular area formed by the fence center and fence radius based on these two parameters, and stores the correspondence between the application information and the fence area information.

[0152] It should be noted that the specific implementation methods of the above fence setting operations are only examples. Users can also use any possible methods to set up fences without any restrictions.

[0153] In some embodiments, before obtaining the fenced area information corresponding to the application, the terminal may construct a correspondence between the request information and the fenced area information.

[0154] Regarding the method of constructing the correspondence between request information and fenced area information, in one possible implementation, the terminal can construct the correspondence between request information and fenced area information based on historical system resource access records.

[0155] Among them, historical system resource access records are used to characterize historical system resource access requests initiated by historical applications in historical geographical locations, as well as the results of those requests.

[0156] In some embodiments, the terminal can use a machine learning model to predict the fenced area information corresponding to the requested information based on various historical geographical locations in the historical system resource access records. For example, the machine learning model can be a convolutional neural network or a graph neural network.

[0157] In other embodiments, the terminal can determine the fenced area information corresponding to the request information based on various historical geographical locations in the historical system resource access records, according to preset rules. For example, the fenced area indicated by the fenced area information can be the smallest area among regions covering 90% of the historical geographical locations.

[0158] In other embodiments, the terminal may also construct a correspondence between request information and fenced area information by using clustering algorithms or other feasible methods based on historical system resource access records, without limitation.

[0159] Regarding the method of constructing the correspondence between request information and fence area information, in another possible implementation, the terminal can construct the correspondence between request information and fence area information based on the fence setting operation when it receives a fence setting operation.

[0160] Optionally, the fence setting operation can be triggered by manual drawing by the user. For example, the user can manually draw the fence area corresponding to different request information on the map, and the terminal stores the correspondence between the request information and the fence area information based on the fence area drawn by the user.

[0161] Optionally, the fence setting operation can also be triggered by the user inputting relevant parameters of the fence area. For example, the user can input the fence center and fence radius of the fence area corresponding to the request information. The terminal determines the corresponding fence area as a circular area formed by the fence center and fence radius based on these two parameters, and stores the correspondence between the request information and the fence area information.

[0162] It should be noted that the specific implementation methods of the above fence setting operations are only examples. Users can also use any possible methods to set up fences without any restrictions.

[0163] It should be noted that the terminal may only construct the correspondence between application information and fence area information, or only construct the correspondence between request information and fence area information. Alternatively, the terminal may construct both the correspondence between application information and fence area information and the correspondence between request information and fence area information simultaneously.

[0164] In this embodiment, the terminal pre-builds the correspondence between application information and fenced area information, and / or pre-builds the correspondence between request information and fenced area information. When it receives a system resource access request initiated by an application, it can determine the fenced area based on the application information and / or request information corresponding to the system resource access request. This enables the terminal to make timely decisions on whether to respond to the system resource access request, thereby improving the terminal's processing efficiency.

[0165] See Figure 5 , Figure 5 This is an exemplary embodiment of the present application providing a diagram illustrating the construction of a correspondence between application information and fence area information, or a correspondence between request information and fence area information, based on a fence setting operation received.

[0166] In some embodiments, upon receiving a fence setting operation, the terminal displays an access management page containing a map.

[0167] like Figure 5In the terminal, an access management page 510 containing a map is displayed. The access management page 510 can be used by the user to draw fenced areas.

[0168] The markers on the map are used to represent historical system resource access requests initiated by historical applications at historical geographical locations, as well as the results of those requests. This is for illustrative purposes only. Figure 5 The location of the marker points in the graph represents the historical geographical location of historical system resource access requests initiated by each application at various times.

[0169] In some embodiments, when a first area editing operation for application information is received on a map, the terminal determines the fenced area indicated by the first area editing operation as the fenced area indicated by the fenced area information corresponding to the application information.

[0170] Specifically, the first area editing operation for application information can be a trigger operation on the first area editing operation control 501. For example, when the user picks up... Figure 5 When using the black pen, the user can specify the target of the black pen's operation, where the target of the black pen's operation is at least one of the application information. For example, when the user specifies the target of the black pen's operation as the application corresponding to application package name A, the user can use the black pen to draw the fence area of ​​the application corresponding to application package name A. As another example, when the user specifies the target of the black pen's operation as an application of the shopping app type, the user can use the black pen to draw the fence area of ​​the shopping app.

[0171] In some embodiments, when a second area editing operation is received on the map in response to the request information, the terminal determines the fenced area indicated by the second area editing operation as the fenced area indicated by the fenced area information corresponding to the request information.

[0172] Specifically, the second area editing operation in response to the requested information can be a trigger operation on the second area editing operation control 502. For example, when the user picks up... Figure 5 When using the white pen in the application, the user can specify the target of the white pen's operation, where the target of the white pen's operation is at least one of the requested information. For example, if the user specifies that the target of the white pen's operation is noon, the user can use the white pen to draw the fenced area corresponding to the application during the noon requested time period. As another example, if the user specifies that the target of the white pen's operation is the requested resource type as precise location data, the user can use the white pen to draw the fenced area corresponding to the precise location data.

[0173] In this embodiment, through the first area editing operation, the user can build the correspondence between application information and fence area information. Through the second area editing operation, the user can build the correspondence between request information and fence area information. The terminal stores the correspondence between application information or request information and fence area information according to the user's area editing operation, so as to respond to the system resource access request initiated by the application in the future.

[0174] In historical system resource access records, the security levels of the system resources requested by an application may vary. For example, in 100 historical system resource access records for a map app, 90 requests requested access to precise location data, while 10 requests requested access to coarse location data. The security level of coarse location data is lower than that of precise location data. As another example, in 50 historical system resource access records for a social media app, 35 requests requested access to microphone data, while 15 requests requested access to camera data. The security level of microphone data is lower than that of camera data.

[0175] Since system resources may have different security levels, the correspondence between application information and fenced area information can be constructed based on historical system resource access records, taking into account the security level of the system resources requested by the application. Alternatively, the correspondence between request information and fenced area information can be constructed based on historical system resource access records.

[0176] In some embodiments, the terminal can filter historical system resource access records based on application information to obtain a first historical system resource access record; based on the request ratio of system resources of different security levels in the first historical system resource access record, a correspondence between application information and fenced area information is constructed.

[0177] The first historical system resource access record is a record of historical system resource access that matches the application information. For example, if the application information is that the application package name is package name A, then the first historical system resource access record is all the historical system resource access records of the application corresponding to package name A.

[0178] In some embodiments, when the proportion of requests for system resources with lower security levels is greater than the proportion of requests for system resources with higher security levels, the area of ​​the fenced area indicated by the fenced area information corresponding to the application information is relatively large; when the proportion of requests for system resources with lower security levels is less than or equal to the proportion of requests for system resources with higher security levels, the area of ​​the fenced area indicated by the fenced area information corresponding to the application information is relatively small. This allows system resource access requests for system resources with higher security levels to be effective within a smaller range, thereby protecting user privacy and security.

[0179] Taking a location data access request as an example, in some embodiments, a system resource access request includes a precise location data access request that requests access to precise location data and a coarse location data access request that requests access to coarse location data.

[0180] Among them, the security level of precise positioning data is higher than that of coarse positioning data.

[0181] For example, Manifest.permission.ACCESS_FINE_LOCATION indicates precise location data access permissions.

[0182] For example, Manifest.permission.ACCESS_COARSE_LOCATION indicates a coarse location data access permission.

[0183] In some embodiments, if the difference between the proportion of coarse location data access requests corresponding to application information and the proportion of precise location data access requests in the first historical system resource access record is greater than a proportion threshold, it is determined that the application information corresponds to the first fenced area information.

[0184] In some embodiments, if the difference between the proportion of coarse location data access requests corresponding to application information and the proportion of precise location data access requests in the first historical system resource access record is less than or equal to a proportion threshold, it is determined that the application information corresponds to the second fenced area information.

[0185] The area of ​​the first fenced area indicated by the first fenced area information is greater than the area of ​​the second fenced area indicated by the second fenced area information.

[0186] Optionally, the percentage threshold can be a value preset by the terminal, such as 30%.

[0187] For example, in the first historical system resource access record corresponding to a shopping app, among the records of accessing location data, the request ratio of coarse location data access requests is 80%, and the request ratio of precise location data access requests is 20%. The difference in ratios is greater than the ratio threshold of 30%, so it can be determined that the application information corresponds to the first fenced area information. As another example, if the request ratio of coarse location data access requests is 60%, and the request ratio of precise location data access requests is 40%, the difference in ratios is less than the ratio threshold of 30%, so it can be determined that the application information corresponds to the second fenced area information.

[0188] Regarding the specific method for determining the first and second fenced area information based on the first historical system resource access records, in one possible implementation, a machine learning model can be used to predict two fenced areas of different sizes based on the historical geographical locations in the first historical system resource access records, and the first fenced area information can be determined based on the fenced area with the larger area, and the second fenced area information can be determined based on the fenced area with the smaller area. In another possible implementation, the first and second fenced area information can also be determined based on the historical geographical locations in the first historical system resource access records according to preset rules. For example, the area covering 90% of the historical geographical locations can be determined as the first fenced area, and the area covering 70% of the historical geographical locations can be determined as the second fenced area.

[0189] See Figure 6 , Figure 6 This is a schematic diagram of a first fenced area and a second fenced area provided in an exemplary embodiment of this application.

[0190] like Figure 6 As shown, the markers on the map represent the historical system resource access requests initiated by historical applications at historical geographical locations in the first historical system resource access record, as well as the results of those requests.

[0191] If the difference between the proportion of coarse location data access requests corresponding to application information and the proportion of precise location data access requests in the first historical system resource access record is greater than the proportion threshold, the terminal determines that the application information corresponds to the first fence area information, wherein the fence area indicated by the first fence area information is the first fence area 601.

[0192] In the first historical system resource access record, if the difference between the proportion of coarse location data access requests corresponding to application information and the proportion of precise location data access requests is less than or equal to a proportion threshold, the terminal determines that the application information corresponds to the second fence area information, wherein the fence area indicated by the second fence area information is the second fence area 602.

[0193] The area of ​​the first fenced area 601 is larger than the area of ​​the second fenced area 602.

[0194] Similarly, in some embodiments, the terminal can filter historical system resource access records based on request information to obtain a second historical system resource access record; based on the request ratio of system resources with different security levels in the second historical system resource access record, a correspondence between request information and fenced area information can be constructed.

[0195] The second historical system resource access record is a record of historical system resource access that matches the request information. For example, if the request information is for a date of January 1, 2024, then the second historical system resource access record is a record of all historical system resource accesses up to January 1, 2024.

[0196] Regarding the specific method for constructing the correspondence between request information and fenced area information based on the request ratios of system resources with different security levels in the second historical system resource access records, in one possible implementation, if the difference between the request ratio of coarse positioning data access requests corresponding to the request information and the request ratio of precise positioning data access requests in the second historical system resource access records is greater than a ratio threshold, then the request information is determined to correspond to the first fenced area information; if the difference between the request ratio of coarse positioning data access requests corresponding to the request information and the request ratio of precise positioning data access requests is less than or equal to a ratio threshold, then the request information is determined to correspond to the second fenced area information.

[0197] The area of ​​the first fenced area indicated by the first fenced area information is greater than the area of ​​the second fenced area indicated by the second fenced area information.

[0198] In this embodiment, different fenced area information is determined when the proportion of requests for resource types with different security levels is different. When the proportion of requests with lower security levels is relatively large, the fenced area is larger, and when the proportion of requests with higher security levels is relatively large, the fenced area is smaller. This allows higher security level system resource acquisition permissions to take effect in a smaller area, thereby improving data security and further preventing applications from stealing user privacy.

[0199] After the terminal responds to the system resource access request initiated by the application based on the fence area information, the terminal can also notify the user to modify the application's system resource access permissions according to the application's request, so as to realize the automated management of the application's system resource access permissions.

[0200] See Figure 7 , Figure 7 This is a flowchart illustrating a terminal notification to a user to modify system resource access permissions for an application, provided in an exemplary embodiment of this application. The process includes the following steps.

[0201] Step 701: Upon receiving a system resource access request from an application, and provided that the application has system resource access permissions, obtain fenced area information.

[0202] Among them, fenced area information is used to indicate fenced areas in the physical world.

[0203] For more information on obtaining fenced area information, please see [link / reference]. Figure 2 The details and related descriptions will not be repeated here.

[0204] Step 702: If the current geographical location is outside the fenced area, prohibit the provision of system resources corresponding to the system resource access request to the application, and update the number of system resource access requests corresponding to the application.

[0205] In one possible implementation, the terminal can set separate counters for each application to count the number of system resource access requests initiated by the application outside the fenced area. For example, when a system resource access request is received from an application and the current geographical location is outside the fenced area, the technical data of the counter for that application is incremented by 1.

[0206] Step 703: If the number of system resource access requests by the application reaches the threshold, display a permission modification prompt message. The permission modification prompt message is used to suggest modifying the application's system resource access permissions.

[0207] In some embodiments, the terminal may display a permission modification prompt message when the number of system resource access requests of an application reaches a threshold within a certain time period (e.g., within 1 day).

[0208] Optionally, the number of times threshold is a value preset by the terminal. The number of times threshold can be the same or different for different applications. For example, for frequently used chat apps, the terminal sets the number of times threshold to 10, while for other apps that are used relatively less, the terminal sets the number of times threshold to 5.

[0209] Optionally, permission modification notifications can be displayed via pop-up notifications, icon notifications, banner notifications, or any other possible means, without restriction.

[0210] In one possible implementation, the permission modification prompt message can inform the user to change the application from having system resource access permissions to not having system resource access permissions; in another possible implementation, the permission modification prompt message can inform the user to change the application from having system resource access permissions in any running state to having system resource access permissions only in the foreground running state.

[0211] In some embodiments, the user can confirm or cancel the permission modification prompt. When the user confirms, the terminal modifies the application's permissions based on the permission modification prompt, thereby preventing the application from abusing its access to system resources.

[0212] See Figure 8 , Figure 8 This is a schematic diagram illustrating data interaction between various components of a terminal when the system resource is location data, provided by an exemplary embodiment of this application. An application initiating a location data access request includes the following data interaction steps.

[0213] Step 1: Application 801 (APP) sends a location data access request to Location Management Component 802 by calling the location data access interface in Location Management Component 802 (LocationManager).

[0214] In some embodiments, the corresponding location data access interfaces are different when application 801 requests location data of different location types. For example, when application 801 requests precise location data, it calls the precise location data access interface in location management component 802; when application 801 requests coarse location data, it calls the coarse location data access interface in location management component 802.

[0215] Step 2: Based on the received location data access request, the location management component 802 sends a location data access signal to the location management service component 803 (LocationManagerService).

[0216] The location data access signal includes the application identifier (appID) of application 801 and the interface information of the location data access interface called by application 801. The application identifier can further include the application package name or the APP number corresponding to the application in the system.

[0217] Step 3: The location management service component 803 determines the application 801 based on the application identifier in the received location data access signal; and determines the location type (locationType) requested by the application 801 based on the interface information in the received location data access signal.

[0218] Step 4: The location management service component 803 sends a permission query request to the permission management component 804 (permissionManager) to query whether the application 801 has the permission to obtain location data for this location type.

[0219] For example, when the location data is precise location data, the location management service component 803 queries the permission management component 804 to see if the application 801 has access to the precise location data.

[0220] Step 5: The permission management component 804 returns the permission query results to the location management service component 803.

[0221] Step 6a: If the permission query result indicates that the application 801 does not have access to location data for this location type, the location management service component 803 sends a request failure message to the location management component 802 to inform the application 801 that it does not have access to location data for this location type.

[0222] Step 6b: If the permission query result indicates that the application 801 has location data access permissions for this location type, the location management service component 803 sends a fence area query request to the fence information management component 805 (LocHistory) and receives the fence area query result returned by the fence information management component 805.

[0223] In this process, either step 6a or step 6b is executed, and after step 6a is completed, the process jumps to step 8. After step 6b is completed, either step 7a or step 7b is executed.

[0224] Step 7a: If the fenced area query result indicates that the current geographic location is outside the fenced area, the location management service component 803 sends a request failure message to the location management component 802 to inform the application 801 that the current geographic location is outside the fenced area.

[0225] Step 7b: If the query result of the fenced area indicates that the current geographical location is within the fenced area, the location management service component 803 obtains the corresponding location data information of the location data access request, and feeds back the location data information to the application 801 through the location management component 802.

[0226] Either step 7a or step 7b may be executed, and step 8 shall be executed after either step 7a or step 7b is completed.

[0227] Step 8: The location management service component 803 calls the fence information management component 805 to store the system resource access record of application 801 in the fence information management component 805.

[0228] The system resource access record includes application information, current geographic location, system resource access request information, and request results. Application information includes the application identifier (appID) and application running state (apState) (including foreground and background running states). The current geographic location includes the latitude and longitude data of the terminal when the application initiated the location data access request. Request information includes the timestamp of the location data access request and the location type of the requested location data (including precise and coarse positioning). Request results include whether the request was successful or failed.

[0229] In some embodiments, the terminal further includes a privacy dashboard 806 and an access management page 807. The privacy dashboard 806 is used to retrieve historical system resource access records from the fence information management component 806 and display these records in a list format. The access management page 807 is used to display the historical system resource access records in the form of map data with maps and markers. In some embodiments, the privacy dashboard 806 and the access management page 807 support mutual navigation. For more information about the privacy dashboard and access management page, see [link to relevant documentation]. Figures 3-6 The details and related descriptions will not be repeated here.

[0230] See Figure 9 , Figure 9 This is a structural block diagram of a system resource access control device provided in an exemplary embodiment of this application. The device includes:

[0231] The acquisition module 901 is used to acquire fenced area information when it receives a system resource access request from an application and the application has system resource access permissions. The fenced area information is used to indicate a fenced area in the physical world.

[0232] Control module 902 is used to provide the application with the system resources corresponding to the system resource access request when the current geographical location is within the fenced area;

[0233] The control module 902 is further configured to prohibit the application from accessing the system resources corresponding to the system resource access request when the current geographical location is outside the fenced area.

[0234] Optionally, the acquisition module 901 is used in at least one of the following ways:

[0235] Based on the correspondence between application information and fence area information, obtain the fence area information corresponding to the application.

[0236] Based on the correspondence between request information and fenced area information, the fenced area information corresponding to the system resource access request is obtained.

[0237] Optionally, the acquisition module 901 is used in at least one of the following ways:

[0238] Based on the correspondence between application package name and fence area information, obtain the fence area information corresponding to the application;

[0239] Based on the correspondence between application type and fence area information, obtain the fence area information corresponding to the application, with different application types corresponding to different fence area information;

[0240] Based on the correspondence between the application's running status and the fenced area information, the fenced area information corresponding to the application is obtained. The application's running status includes foreground running status and background running status.

[0241] Optionally, the acquisition module 901 is used in at least one of the following ways:

[0242] Based on the correspondence between the request time period and the fence area information, the fence area information corresponding to the system resource access request is obtained;

[0243] Based on the correspondence between resource type and fenced area information, the fenced area information corresponding to the system resource access request is obtained, where the resource type refers to the type of system resource requested for access.

[0244] Optionally, the device further includes a display module for:

[0245] Based on the application information of the application, the current geographical location, the request information of the system resource access request, and the request result, a historical system resource access record is generated;

[0246] In response to the viewing operation of the historical system resource access records, marker points are displayed on the map based on the historical system resource access records. The marker points are used to represent the historical system resource access requests initiated by historical applications at historical geographical locations and the results of the historical requests.

[0247] Optional, display module, used for:

[0248] In response to a filtering operation on the historical system resource access records, the markers displayed on the map are updated based on the filtering conditions indicated by the filtering operation, wherein the filtering conditions include at least one of application information filtering conditions and request information filtering conditions.

[0249] Optional, display module, used for:

[0250] In response to the fence area display operation, target fence area information matching the filtering conditions is determined, the target fence area information corresponding to the application information indicated by the application information filtering conditions, and / or, the target fence area information corresponding to the request information indicated by the request information filtering conditions;

[0251] Based on the target fence area information, the target fence area is displayed on the map.

[0252] Optionally, the device further includes a construction module, which, before obtaining the fence area information corresponding to the application, is used in at least one of the following ways:

[0253] Establish the correspondence between the application information and the fenced area information;

[0254] Establish the correspondence between the request information and the fenced area information.

[0255] Optionally, a building module may be used in at least one of the following ways:

[0256] Based on historical system resource access records, a correspondence is constructed between the application information and the fenced area information, or a correspondence is constructed between the request information and the fenced area information, wherein the historical system resource access records are used to characterize historical system resource access requests initiated by historical applications in historical geographical locations and the results of those requests.

[0257] Upon receiving a fence setting operation, a correspondence is established between the application information and the fence area information based on the fence setting operation, or a correspondence is established between the request information and the fence area information.

[0258] Optional, building modules, used for:

[0259] Based on the application information, the historical system resource access records are filtered to obtain the first historical system resource access record; based on the request ratio of system resources with different security levels in the first historical system resource access record, the correspondence between the application information and the fenced area information is constructed.

[0260] Based on the request information, the historical system resource access records are filtered to obtain a second historical system resource access record; based on the request ratio of system resources with different security levels in the second historical system resource access record, a correspondence between the request information and the fenced area information is constructed.

[0261] Optionally, the system resource access request includes a precise positioning data access request for accessing precise positioning data and a coarse positioning data access request for accessing coarse positioning data, wherein the security level of the precise positioning data is higher than the security level of the coarse positioning data; the construction module is used for:

[0262] If, in the first historical system resource access record, the difference between the proportion of the coarse location data access request corresponding to the application information and the proportion of the precise location data access request is greater than a proportion threshold, it is determined that the application information corresponds to the first fence area information.

[0263] If, in the first historical system resource access record, the difference between the proportion of the coarse location data access request corresponding to the application information and the proportion of the precise location data access request is less than or equal to the proportion threshold, then the application information is determined to correspond to the second fence area information.

[0264] Wherein, the area of ​​the first fenced area indicated by the first fenced area information is greater than the area of ​​the second fenced area indicated by the second fenced area information.

[0265] Optional, building modules, used for:

[0266] Displays an access management page containing a map, where markers represent historical system resource access requests initiated by historical applications at historical geographical locations, as well as the results of those requests.

[0267] Upon receiving a first area editing operation on the map for the application information, the fenced area indicated by the first area editing operation is determined as the fenced area indicated by the fenced area information corresponding to the application information;

[0268] Upon receiving a second area editing operation on the map in response to the request information, the fenced area indicated by the second area editing operation is determined as the fenced area indicated by the fenced area information corresponding to the request information.

[0269] Optionally, the device further includes a permission modification module, used for:

[0270] If the current geographical location is outside the fenced area, update the number of system resource access requests corresponding to the application;

[0271] If the number of system resource access requests made by the application reaches a certain threshold, a permission modification prompt will be displayed to suggest modifying the application's access permissions to the system resources.

[0272] Optionally, the system resource access request includes an access request for at least one system resource selected from location data, camera data, microphone data, sensor data, photo album data, contact list data, and file data.

[0273] See Figure 10 , Figure 10 This is a structural block diagram of a terminal provided in an exemplary embodiment of this application.

[0274] The terminal can execute the system resource access control method described in the above embodiments. The terminal can be an electronic device that supports running applications, such as a smartphone, laptop, tablet, navigation device, smart TV, etc. The terminal may also be referred to as a user equipment, portable terminal, or other names. The terminal may include one or more of the following components: processor 1010 and memory 1020.

[0275] Optionally, the processor 1010 connects various parts within the electronic device using various interfaces and lines. It executes various functions and processes data by running or executing instructions, programs, code sets, or instruction sets stored in the memory 1020, and by calling data stored in the memory 1020. Optionally, the processor 1010 can be implemented using at least one hardware form of Digital Signal Processing (DSP), Field-Programmable Gate Array (FPGA), or Programmable Logic Array (PLA). The processor 1010 can integrate one or more of the following: Central Processing Unit (CPU), Graphics Processing Unit (GPU), Neural-network Processing Unit (NPU), and baseband chip. Specifically, the CPU primarily handles the operating system, user interface, and applications; the GPU is responsible for rendering and drawing the content required for display on the touch screen; the NPU is used to implement Artificial Intelligence (AI) functions; and the baseband chip is used for wireless communication. It is understandable that the aforementioned baseband chip may not be integrated into the processor 1010, but may be implemented using a separate chip.

[0276] The memory 1020 may include random access memory (RAM) or read-only memory (ROM). Optionally, the memory 1020 may include a non-transitory computer-readable storage medium. The memory 1020 may be used to store instructions, programs, code, code sets, or instruction sets. The memory 1020 may include a program storage area and a data storage area, wherein the program storage area may store instructions for implementing an operating system, instructions for at least one function (such as touch function, sound playback function, image playback function, etc.), instructions for implementing the various method embodiments described below, etc.; the data storage area may store data created according to the use of the electronic device (such as audio data, phone book, etc.).

[0277] In addition, those skilled in the art will understand that the structure of the terminal shown in the above figures does not constitute a limitation on the terminal. The terminal may include more or fewer components than shown, or combine certain components, or have different component arrangements.

[0278] This application also provides a computer-readable storage medium storing at least one computer instruction, which is loaded and executed by a processor to implement the method described in the above embodiments. Optionally, the computer-readable storage medium may include ROM, RAM, solid-state drives (SSDs), or optical discs, etc. The RAM may include resistive random access memory (ReRAM) and dynamic random access memory (DRAM).

[0279] This application also provides a computer program product or computer program that includes computer instructions stored in a computer-readable storage medium. A processor of a computer device reads the computer instructions from the computer-readable storage medium and executes the computer instructions, causing the computer device to perform the methods provided in the various optional implementations of the above aspects.

[0280] The above description is merely an optional embodiment of this application and is not intended to limit this application. Any modifications, equivalent substitutions, improvements, etc., made within the spirit and principles of this application should be included within the protection scope of this application.

Claims

1. A method for access control of system resources, characterized in that, The method includes: Upon receiving a system resource access request from an application, and provided that the application has system resource access permissions, fenced area information is obtained, which is used to indicate fenced areas in the physical world. If the current geographical location is within the fenced area, provide the application with the system resources corresponding to the system resource access request; If the current geographical location is outside the fenced area, the system resources corresponding to the system resource access request are prohibited from being provided to the application.

2. The method according to claim 1, characterized in that, The acquisition of fenced area information includes at least one of the following methods: Based on the correspondence between application information and fence area information, obtain the fence area information corresponding to the application. Based on the correspondence between request information and fenced area information, the fenced area information corresponding to the system resource access request is obtained.

3. The method according to claim 2, characterized in that, The method of obtaining the fence area information corresponding to the application based on the correspondence between application information and fence area information includes at least one of the following methods: Based on the correspondence between application package name and fence area information, obtain the fence area information corresponding to the application; Based on the correspondence between application type and fence area information, obtain the fence area information corresponding to the application, with different application types corresponding to different fence area information; Based on the correspondence between the application's running status and the fenced area information, the fenced area information corresponding to the application is obtained. The application's running status includes foreground running status and background running status.

4. The method according to claim 2, characterized in that, The method of obtaining the fenced area information corresponding to the system resource access request based on the correspondence between request information and fenced area information includes at least one of the following methods: Based on the correspondence between the request time period and the fence area information, the fence area information corresponding to the system resource access request is obtained; Based on the correspondence between resource type and fenced area information, the fenced area information corresponding to the system resource access request is obtained, where the resource type refers to the type of system resource requested for access.

5. The method according to claim 2, characterized in that, The method further includes: Based on the application information of the application, the current geographical location, the request information of the system resource access request, and the request result, a historical system resource access record is generated; The method further includes: In response to the viewing operation of the historical system resource access records, marker points are displayed on the map based on the historical system resource access records. The marker points are used to represent the historical system resource access requests initiated by historical applications at historical geographical locations and the results of the historical requests.

6. The method according to claim 5, characterized in that, The method further includes: In response to a filtering operation on the historical system resource access records, the markers displayed on the map are updated based on the filtering conditions indicated by the filtering operation, wherein the filtering conditions include at least one of application information filtering conditions and request information filtering conditions.

7. The method according to claim 6, characterized in that, The method further includes: In response to the fence area display operation, target fence area information matching the filtering conditions is determined, the target fence area information corresponding to the application information indicated by the application information filtering conditions, and / or, the target fence area information corresponding to the request information indicated by the request information filtering conditions; Based on the target fence area information, the target fence area is displayed on the map.

8. The method according to claim 2, characterized in that, Before obtaining the fence area information corresponding to the application, the method further includes at least one of the following methods: Establish the correspondence between the application information and the fenced area information; Establish the correspondence between the request information and the fenced area information.

9. The method according to claim 8, characterized in that, The process of constructing the correspondence between the application information and the fenced area information, or the process of constructing the correspondence between the request information and the fenced area information, includes at least one of the following methods: Based on historical system resource access records, a correspondence is constructed between the application information and the fenced area information, or a correspondence is constructed between the request information and the fenced area information, wherein the historical system resource access records are used to characterize historical system resource access requests initiated by historical applications in historical geographical locations and the results of those requests. Upon receiving a fence setting operation, a correspondence is established between the application information and the fence area information based on the fence setting operation, or a correspondence is established between the request information and the fence area information.

10. The method according to claim 9, characterized in that, The process of constructing the correspondence between the application information and the fenced area information based on historical system resource access records includes: Based on the application information, the historical system resource access records are filtered to obtain the first historical system resource access record; based on the request ratio of system resources with different security levels in the first historical system resource access record, the correspondence between the application information and the fenced area information is constructed. The step of constructing the correspondence between the request information and the fenced area information based on historical system resource access records includes: Based on the request information, the historical system resource access records are filtered to obtain a second historical system resource access record; based on the request ratio of system resources with different security levels in the second historical system resource access record, a correspondence between the request information and the fenced area information is constructed.

11. The method according to claim 10, characterized in that, The system resource access requests include precise location data access requests for precise location data and coarse location data access requests for coarse location data, and the security level of the precise location data is higher than that of the coarse location data. The step of constructing the correspondence between the application information and the fenced area information based on the request ratio of system resources with different security levels in the first historical system resource access record includes: If, in the first historical system resource access record, the difference between the proportion of the coarse location data access request corresponding to the application information and the proportion of the precise location data access request is greater than a proportion threshold, it is determined that the application information corresponds to the first fence area information. If, in the first historical system resource access record, the difference between the proportion of the coarse location data access request corresponding to the application information and the proportion of the precise location data access request is less than or equal to the proportion threshold, then the application information is determined to correspond to the second fence area information. Wherein, the area of ​​the first fenced area indicated by the first fenced area information is greater than the area of ​​the second fenced area indicated by the second fenced area information.

12. The method according to claim 9, characterized in that, Upon receiving a fence setting operation, the step of constructing a correspondence between the application information and the fence area information, or constructing a correspondence between the request information and the fence area information, includes: Displays an access management page containing a map, where markers represent historical system resource access requests initiated by historical applications at historical geographical locations, as well as the results of those requests. Upon receiving a first area editing operation on the map for the application information, the fenced area indicated by the first area editing operation is determined as the fenced area indicated by the fenced area information corresponding to the application information; Upon receiving a second area editing operation on the map in response to the request information, the fenced area indicated by the second area editing operation is determined as the fenced area indicated by the fenced area information corresponding to the request information.

13. The method according to any one of claims 1 to 12, characterized in that, The method further includes: If the current geographical location is outside the fenced area, update the number of system resource access requests corresponding to the application; If the number of system resource access requests made by the application reaches a certain threshold, a permission modification prompt will be displayed to suggest modifying the application's access permissions to the system resources.

14. The method according to any one of claims 1 to 12, characterized in that, The system resource access request includes an access request for at least one system resource selected from location data, camera data, microphone data, sensor data, photo album data, contact list data, and file data.

15. A system resource access control device, characterized in that, The device includes: The acquisition module is used to acquire fenced area information when it receives a system resource access request from an application and the application has system resource access permissions. The fenced area information is used to indicate fenced areas in the physical world. The control module is used to provide the application with the system resources corresponding to the system resource access request when the current geographical location is within the fenced area; The control module is also configured to prohibit the application from accessing the system resources corresponding to the system resource access request when the current geographical location is outside the fenced area.

16. A terminal, characterized in that, The terminal includes a processor and a memory; the memory stores at least one computer instruction, which is executed by the processor to implement the system resource access control method as described in any one of claims 1 to 14.

17. A computer-readable storage medium, characterized in that, The computer-readable storage medium stores at least one computer instruction, which is loaded and executed by a processor to implement the system resource access control method as described in any one of claims 1 to 14.

18. A computer program product, characterized in that, The computer program product includes computer instructions stored in a computer-readable storage medium; a processor of the terminal reads the computer instructions from the computer-readable storage medium and executes the computer instructions, causing the terminal to perform the system resource access control method as described in any one of claims 1 to 14.

Images